SOC Operations Architect / Senior SOC Lead

Job Title: SOC Operations Architect / Senior SOC Lead
Location: Remote or Hybrid – Candidate must be located in California
Duration: + Months
Position Overview: The consultant will help convert the security operations model into practical SOC workflows, runbooks, escalation procedures, detection requirements, telemetry integrations, and operational processes. This person will also work closely with cybersecurity vendors, campus security teams, technical teams, and leadership to review proposed designs, identify gaps, clarify ownership, and ensure the SOC service can be effectively operated and sustained.

Key Responsibilities

• Design and refine SOC workflows for monitoring, detection, alert triage, investigation, escalation, incident handoff, and response coordination.
• Develop SOC runbooks, playbooks, procedures, severity models, escalation logic, and operational documentation.
• Review vendor SOC/MSSP/MDR operating processes, technical designs, integrations, workflows, and implementation plans.
• Identify technical gaps, operational risks, unclear ownership, and responsibility boundaries.
• Validate monitoring use cases, detection rules, alert quality, reporting, and SOC operational metrics.
• Review security telemetry from identity platforms, endpoints, firewalls, VPNs, IDS/IPS, and other security sources.
• Support SIEM, EDR, identity, ITSM, and security platform integration requirements.
• Help determine ownership of security responsibilities across the vendor, Cyber Fusion Center, CSU campuses, and other teams.
• Support SOC pilot readiness through workflow testing, tabletop exercises, scenario validation, and issue tracking.
• Coordinate with cybersecurity vendors, CFC leadership, campus security teams, and project stakeholders.

Required Qualifications

• Senior-level experience in SOC Operations, Security Operations, Incident Response, Detection Engineering, Security Architecture, or Cybersecurity Operations.
• Strong experience designing, establishing, transitioning, or maturing Security Operations Center (SOC) capabilities.
• Strong knowledge of SOC architecture and service integration.
• Hands-on experience with: Alert triage and investigation Incident escalation and handoff Incident response coordination Detection use cases SOC workflows and operational processes
• Experience with SIEM and security platform integrations.
• Strong understanding of: Security telemetry flows Identity correlation Alert lifecycle management Access models ITSM integration
• Experience managing or working closely with MSSP, MDR, SOC, SIEM, or cybersecurity service vendors.
• Experience reviewing vendor technical designs and deliverables and identifying implementation or service gaps.
• Strong knowledge of incident severity models, escalation criteria, detection rules/use cases, SOC metrics, and reporting.
• Experience developing SOC runbooks, playbooks, procedures, workflow diagrams, or operational documentation.
• Experience working with security technologies and telemetry including: SIEM EDR Identity/IAM Firewalls VPN IDS/IPS
• Strong technical documentation, communication, and stakeholder-management skills.

Preferred Qualifications

• Experience within higher education, government/public sector, federated organizations, or large multi-entity environments.
• Experience supporting enterprise-wide or distributed SOC implementations.
• Experience coordinating security operations across multiple business units, campuses, agencies, or organizational entities.

About Us:
InterSources Inc , is a Small, Woman, and Minority-Owned Business Enterprise, ISO/IEC , SOC Type certified company with massive + years of diversified experience in providing IT Consulting Services, Artificial Intelligence, Data Analysis, Application Development, Cloud Services, Cybersecurity, Digital Marketing, ERP Management, Custom Software Development, Web Development, UI/ UX Design, System Integration, QA Support etc. We make reasonable accommodations for clients and employees, and we do not discriminate based on any protected attribute including race, religion, color, national origin, gender sexual orientation, gender identity, age, or marital status. We also are a Google Cloud and Oracle partner company.